Google Gemini was found to allow downloading of AI-generated images its safety filters had explicitly blocked, according to a recent report by Fog Security. The issue emerged from a flaw in the Gemini web app’s handling of download functionality, which sometimes delivered prohibited content even when only an allowed image appeared during the chat.
What Happened
Researchers from Fog Security discovered in June 2026 that when using Gemini in a browser, blocked images—ones Gemini’s safety system refused to display—could nonetheless be downloaded in full via the “download” link. Despite the chat’s refusal and display of a different safe image, the full-size download occasionally pulled the suppressed content. The issue was traced to how image URLs and downloads were handled compared to on-screen previews. Downloads used signed URLs ending in “=s0-d-I,” while inline previews used different suffixes like “=s1024-rj.”
Response and Resolution
Fog Security reported the problem to Google in June. By October 22, attempts to reproduce the bypass (in twelve fresh trials) failed, and older chats no longer produced the forbidden images via download. Google attributed the resolution to routine maintenance rather than labeling it a direct fix of a reported security bug.
The root cause appeared to stem from a misstep in state management—how Gemini kept track of which images were supposed to be blocked, which ones were displayed in previews, and which were available for download. This defect did not involve advanced attacks like prompt injections or jailbreaks. Rather, it was a flaw in enforcing the safety rules across all access paths.
Scope and Limitations
The test cases conducted by Fog Security included scenarios involving copyrighted characters, AI-generated synthetic people, and even the researchers’ own likenesses. The flaw did not extend to more sensitive or high-risk domains like child safety content or real people’s images beyond those used in experiment. Nor was there any evidence of a breach of user data or elevated account access.
Google initially considered the issue out of its bug bounty or abuse-tracking programs to be out of scope. After follow-ups from Fog Security over several months, more scrutiny was applied. While Google claimed no official ticket had been filed by late September, the company later said the download issue was no longer reproducible in recent instances.
What’s Being Recommended
Fog Security suggests a tighter linkage between previews and downloadable content—making sure any image approved for viewing must match what can be stored or retrieved. Specifically, they call for removing files associated with failed generations and blocked content, and ensuring downloads follow the same safety decisions as displayed content.
This situation underscores that safety protections must extend beyond what users see in chat—to stored files, URLs, and all paths by which content reaches a user. If only the chat response is guarded, but other routes like downloads aren’t, the system remains vulnerable.
Why This Matters: Systems like Gemini are building blocks of future AI-driven content platforms. A mismatch between what’s seen and what’s downloadable not only poses risk of unintentional exposure to banned content, but can erode trust in these tools’ safety assurances.
